Lucene search

K
attackerkbAttackerKBAKB:7F90AA6A-DBC0-4624-92ED-89EF53BD0D94
HistoryFeb 11, 2020 - 12:00 a.m.

CVE-2020-0753

2020-02-1100:00:00
attackerkb.com
16

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

9.5%

An elevation of privilege vulnerability exists in Windows Error Reporting (WER) when WER handles and executes files, aka ‘Windows Error Reporting Elevation of Privilege Vulnerability’. This CVE ID is unique from CVE-2020-0754.

Recent assessments:

tekwizz123 at February 23, 2020 6:25pm UTC reported:

A technical writeup for this bug was published today and is available at <https://github.com/afang5472/CVE-2020-0753-and-CVE-2020-0754/blob/master/WERReport-CVE-2020-0753/POC.md&gt; along with a working PoC. The vulnerability itself exists within CWerService::SvcMergeETWLogs within Wersvc.dll according to the writeup.

From what I can see in the writeup the bug is a race condition which is relatively difficult to exploit, however because it is within the Windows Error Reporting Service it should be available by default on most Windows systems. Successful exploitation will result in arbitrary file deletion as the SYSTEM user.

Rated this as medium on exploitation as whilst it is a race condition, the fact that one is able to gain a 4-5 second window to exploit the bug by taking advantage of how the GetTempFileNameW() operation works. for generating the temp file name. Basically by prepopulating a directory with all file names from WER0000.tmp to WERFFFE.tmp (aka 0000 to FFFE), one forces GetTempFileNameW() to generate a file with the name WERFFFF.tmp.

Then following steps are executed (taken from writeup):

Then , I put all the WER***.tmp in \(pwd\1, and junction \)pwd\2\ –> $pwd\1;

we create a process to continuously trigger this function with the path \(pwd\2\. and create the other process to continuously execute the command SetOplock \)pwd\1\WERFFFF.tmp;

Once the Oplock is triggered , we junction \(pwd\2\ -> \RPC CONTROL, and then create object symbolic \RPC CONTROL\WERFFFF.tmp -> \)target and \RPC CONTROL\WERFFFF.tmp.etl –> $target

Release the oplock , the target file will be deleted with system privilege

Assessed Attacker Value: 2
Assessed Attacker Value: 2Assessed Attacker Value: 3

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

4.6 Medium

CVSS2

Access Vector

LOCAL

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:L/AC:L/Au:N/C:P/I:P/A:P

0.0004 Low

EPSS

Percentile

9.5%